{"id":183718,"date":"2026-10-09T10:54:03","date_gmt":"2026-10-09T08:54:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/uyazvimost-v-telegram-desktop-pozvolyayushhaya-otpravit-proizvolnye-fajly-pri-klike-na-ssylku"},"modified":"2026-10-09T10:54:09","modified_gmt":"2026-10-09T08:54:09","slug":"telegram-desktop-vulnerability-allows-arbitrary-files-to-be-sent-when-a-link-is-clicked","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/telegram-desktop-vulnerability-allows-arbitrary-files-to-be-sent-when-a-link-is-clicked","title":{"rendered":"Hiba a Telegram Desktopban, amely lehet\u0151v\u00e9 teszi tetsz\u0151leges f\u00e1jlok k\u00fcld\u00e9s\u00e9t, ha a linkre kattintanak.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A Telegram Desktop, a Telegram oficialis asztali kliens\u00e9nek egy s\u00e9r\u00fcl\u00e9kenys\u00e9g\u00e9r\u0151l (CVE-2026-107181) sz\u00e1rmaz\u00f3 r\u00e9szletek \u00e9s kihaszn\u00e1l\u00e1si m\u00f3dszer der\u00fcltek ki. A probl\u00e9ma a nem megfelel\u0151en kezeltek, nem sz\u0171rt szepar\u00e1tor karaktereknek k\u00f6sz\u00f6nhet\u0151 az IPC parancsokban, ami lehet\u0151v\u00e9 tette, hogy a k\u00fcld\u00f6tt linkre kattintva az t\u00e1mad\u00f3 b\u00e1rmilyen f\u00e1jlt \u00e1tadjon az \u00e1ldozat rendszer\u00e9b\u0151l, bele\u00e9rtve a szekr\u00e9nykulcsokkal rendelkez\u0151 f\u00e1jlokat is, melyeket a Telegram fi\u00f3k megszerz\u00e9s\u00e9re lehet haszn\u00e1lni. A s\u00e9r\u00fcl\u00e9kenys\u00e9get a Telegram Desktop 7.2.9-es kiad\u00e1s\u00e1ban jav\u00edtott\u00e1k.<\/p>\n
A link click on 'tg:\/\/' launches the application associated with these types of links, Telegram Desktop. If another instance of this application is already running, the launched process passes the link to it via a socket using the IPC interface. The problem is that if the ';' symbol is included among the link parameters (for example, 'tg:\/\/x?a=1;OPEN...'), the content is split, and the parts after the ';' symbol are processed as separate commands.<\/p>\n
To carry out the attack, the OPEN command is used along with the URI scheme 'interpret:', which is designed to run service scripts through IPC, used for automatically sending new releases to channels. The script refers to a predefined local file that specifies the file sent to the channel and the channel ID. The file path to the scripts is processed relative to the service subdirectory, but due to the lack of cleaning up '..' in file paths, the attacker can access files saved outside the base directory. For example, a file can be uploaded to their Telegram group, after which this file can be referenced as a script by preparing a link like:<\/p>\n
A t\u00e1mad\u00e1s v\u00e9grehajt\u00e1s\u00e1nak l\u00e9p\u00e9sei:<\/p>\n
\n
A t\u00e1mad\u00f3 hozz\u00e1adja az \u00e1ldozatot a csoportj\u00e1hoz (alap\u00e9rtelmezett be\u00e1ll\u00edt\u00e1sok eset\u00e9n a hozz\u00e1ad\u00e1s nem ig\u00e9nyel meger\u0151s\u00edt\u00e9st) \u00e9s k\u00fcld ebbe a csoportba egy sz\u00f6veges f\u00e1jlt, amelyben a csatorna \u00e9s a szkripthez vezet\u0151 \u00fatvonal szerepel. A Telegram ezt a f\u00e1jlt a beregisztr\u00e1l\u00f3 \u00e1ldozat csoportba l\u00e9p\u00e9skor egy el\u0151re meghat\u00e1rozott rendszer almapp\u00e1ba menti.\n